Open RFC Meeting (npm)

#### Meeting from: 2021-02-24 # Open RFC Meeting (npm) ### Attendees - Darcy Clarke (@darcyclarke) - Ruy Adorno (@ruyadorno) - Nathan LaFreniere (@nlf) - Tierney Cyren (@bnb) - Jordan Harband (@ljharb) - Gar (@wraithgar) - Caleb Boyd (@calebsboyd) - Rick Markins (@rxmarbles) - Isaac Z. Schlueter (@isaacs) ### Agenda 1. **Housekeeping** 1. Introduction(s) (ex. note the name of the call, state the week day & date) 1. [Code of Conduct Acknowledgement](https://www.npmjs.com/policies/conduct) 1. Outline Intentions & Desired Outcomes (ex. want to interact with the community to ensure that there is movement on important issues/ideas for the project) 1. Announcements 1. **Issue**: [#327 Drop support for installing other-platform optionalDependencies with --force](https://github.com/npm/rfcs/issues/327) - @isaacs 1. **Issue**: [#325 [RRFC] Run preinstall / postinstall scripts on single package installation](https://github.com/npm/rfcs/issues/325) - @karlhorky 1. **Issue**: [#324 [RRFC] Prefer peerDependencies over regular dependencies, when both specified together](https://github.com/npm/rfcs/issues/324) - @larixer 1. **PR**: [#117 RFC: npm workspaces - Working with workspaces](https://github.com/npm/rfcs/pull/117) - @ruyadorno 1. **Issue**: [#323 [RRFC] Improve experience and security around npx and scoped packages](https://github.com/npm/rfcs/issues/323) - @dominykas 1. **PR**: [#321 feat(no-tag-publish): add proposal for a no-tag publish](https://github.com/npm/rfcs/pull/321) - @wraithgar 1. **PR**: [#319 feat(multiple-dist-tags): add proposal for multiple dist-tags](https://github.com/npm/rfcs/pull/319) - @wraithgar 1. **PR**: [#317 RFC: Publish set the tag accordingly to the semver version number](https://github.com/npm/rfcs/pull/317) - @Divlo 1. **PR**: [#314 RFC: `registry:` dependency specifiers](https://github.com/npm/rfcs/pull/314) - @isaacs 1. **Issue**: [#313 [RRFC] Add method for getting help on config option](https://github.com/npm/rfcs/issues/313) - @Yash-Singh1 1. **Issue**: [#2610 [BUG] NPM v7 uses SSH instead of an explicit HTTPS for GitHub repos](https://github.com/npm/cli/issues/2610) - @uhop ### Notes #### **Issue**: [#327 Drop support for installing other-platform optionalDependencies with --force] #### **Issue**: [#325 [RRFC] Run preinstall / postinstall scripts on single package installation](https://github.com/npm/rfcs/issues/325) - @karlhorky * @isaacs General-purpose tree-install-has-changed script might be a better way to think about it, e.g: tree-mutated, mutation, lifecycle event * @ljharb it should run only for the top-level project and not for any project installing a package that has this lifecycle event * @isaacs maybe also have different lifecycle events for "tree has been reified" (only putting deps to disk instead of building an ideal install tree) vs "tree has been changed" (actually changing the ideal install tree during npm install) * @ljharb might be better to think about from a more user-friendly point of view, reify and these other arborist-terminologies might be too much internal details for end users * @isaacs the "install tree has changed" generic lifecycle event might be a suitable solution to handle a variety of end user needs #### **Issue**: [#324 [RRFC] Prefer peerDependencies over regular dependencies, when both specified together](https://github.com/npm/rfcs/issues/324) - @larixer * @isaacs Already implemented, #### **Issue**: [#323 [RRFC] Improve experience and security around npx and scoped packages](https://github.com/npm/rfcs/issues/323) - @dominykas * @wesleytodd Should break this up into multiple RFCs #### **PR**: [#117 RFC: npm workspaces - Working with workspaces](https://github.com/npm/rfcs/pull/117) - @ruyadorno * @ruyadorno * we've been moving forward with Workspaces work & had some internal discussions about how basic commands will function * demo of initial POC (`npm ws`, `npm ws ls`) * we are leaning towards consolidating workspace functionality through a top-level commaned (ie. `npm ws`) * removing alias'/groups from initial RFC - will explore this after initial command support/work has completed * @ljharb have one scenario ie. `npm exec foo` * @ljharb we should be able to cd into a workspace path and run the top-level command and have the same result as running `npm ws <cmd>` (also: let's clean up the confusing glossary of workspaces terminology) * @isaacs we identified 5 different categories of top-level commands that would fall into different type of handling * @ruyadorno categories of commands: * do nothing/does nothing to install tree * scopes/filters the install tree * `cd`'s & iterates as if it was a normal user * Custom implementation / case-by-case * do not apply, should probably exit with code 1 * @isaacs with arborist as-is today, workspaces are always hoisted within your install tree / node_modules * @ruyadorno would love to get feedback/sentiment of `npm ws <cmd>` vs. `npm <cmd> -ws` * @ljharb can the `-w|--workspace` be specified anywhere? * @isaacs yeah, it's the usual npm config story and something we are also planning to clean up in npm8 * @bnb how do we point internal workspaces to different registries? * @darcyclarke action items, clean up including the de-scoping of some features such as Groups/Alias #### **PR**: [#319 feat(multiple-dist-tags): add proposal for multiple dist-tags](https://github.com/npm/rfcs/pull/319) - @wraithgar * @isaacs Maybe we should take this off the agenda while the public registry doesn't support it? * @darcyclarke It might be better to move forward with it given that other registries currently already support it, let's leave it open for another week and if there are no blockers we may look into ratifying it next week #### **PR**: [#317 RFC: Publish set the tag accordingly to the semver version number](https://github.com/npm/rfcs/pull/317) - @Divlo * @isaacs we should avoid changing legacy behavior since there might be users relying on that default behavior even in cases the default behavior does not make sense. * @wesleytodd the fundamental problem they're trying to avoid here is publishing to `latest` by mistake * @ljharb Also: `npm publish --no-tag` should work and publish to the registry under no tag * [Prompts in `npm publish` might help improve the situtation](https://github.com/npm/rfcs/blob/c619bfc0a148a1d8baf4b0ec15c8693648c6a73b/accepted/0028-publish-prompt.md) #### **PR**: [#314 RFC: `registry:` dependency specifiers](https://github.com/npm/rfcs/pull/314) - @isaacs * @isaacs there's an open-ended question currently: * A package author publishing a private package to a private registry has the assumption that dependencies of that package are also coming from the private registry, e.g: ``` $ npm install foo --registry=<private> foo <-- installed from <private> registry +- bar <-- installed from <private> registry ```